CVE-2022-23561

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions prior to 2.7.1 TensorFlow versions prior to 2.6.3 TensorFlow versions prior to 2.5.3

Description An attacker can craft a TFLite model to cause a write outside the bounds of an array in TFLite, potentially overriding the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions prior to 2.7.1, update to TensorFlow 2.7.1 or later. For versions prior to 2.6.3, update to TensorFlow 2.6.3 or later. For versions prior to 2.5.3, update to TensorFlow 2.5.3 or later.